CVE-2026-71475

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.

• CWE-22

• https://access.redhat.com/errata/RHSA-2026:60386
• https://access.redhat.com/errata/RHSA-2026:60388
• https://access.redhat.com/errata/RHSA-2026:60389
• https://access.redhat.com/errata/RHSA-2026:60390
• https://access.redhat.com/errata/RHSA-2026:60391
• https://access.redhat.com/security/cve/CVE-2026-71475Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2512154Issue Tracking, Vendor Advisory

Published

Aug 11, 2026

Last Modified

Sep 5, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7147A vulnerability was detected in JoeCastrom mcp-chat-studio u…7.3
• CVE-2026-71470A flaw was found in the search-v2-operator. This vulnerabili…9.1
• CVE-2026-71471A flaw was found in acm-search-v2-rhel9. An attacker with ad…9
• CVE-2026-71472A flaw was found in acm-search-v2-rhel9. This vulnerability …9.1
• CVE-2026-71473A flaw was found in the `search-v2-operator` component. A us…8.5
• CVE-2026-71474A flaw was found in insights-client. When the application re…7.1
• CVE-2026-71476Nx is a monorepo solution for TypeScript and polyglot codeba…8.7
• CVE-2026-71477mise manages dev tools like node, python, cmake, and terrafo…6.7
• CVE-2026-71478league/commonmark is a PHP library for parsing and rendering…6.1
• CVE-2026-71479New API is a large language mode (LLM) gateway and artificia…9.1
• CVE-2026-7148A flaw has been found in CodeAstro Online Classroom 1.0. Thi…6.3
• CVE-2026-71483Horilla is an HR and CRM software. Prior to 1.6.0, the searc…8.5